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Abstract 

In this paper we propose a quantum random number generator (QRNG) which utilizes an entangled pho- 
ton pair in a Bell singlet state, and is certified explicitly by value indefiniteness. While "true randomness" is 
a mathematical impossibility, the certification by value indefiniteness ensures the quantum random bits are 
incomputable in the strongest sense. This is the first QRNG setup in which a physical principle (Kochen- 
Specker value indefiniteness) guarantees that no single quantum bit produced can be classically computed 
(reproduced and validated), the mathematical form of bitwise physical unpredictability. 

The effects of various experimental imperfections are discussed in detail, particularly those related to 
detector efficiencies, context alignment and temporal correlations between bits. The analysis is to a large 
extent relevant for the construction of any QRNG based on beam-splitters. By measuring the two entan- 
gled photons in maximally misaligned contexts and utilizing the fact that two rather than one bitstring are 
obtained, more efficient and robust unbiasing techniques can be applied. A robust and efficient procedure 
based on XORing the bitstrings together — essentially using one as a one-time-pad for the other — is proposed 
to extract random bits in the presence of experimental imperfections, as well as a more efficient modification 
of the von Neumann procedure for the same task. Some open problems are also discussed. 
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I. INTRODUCTION 



Random numbers have been around for more than 4,000 years, but never have they been in 
such demand as in our time. People use random numbers everywhere. Thereby, randomness is 
understood through various "symptoms." Here are three of the largely accepted ones: 

(i) Unpredictability: It is impossible to win against a random sequence in a fair betting game. 

(ii) Incompressibility: It is impossible to compress a random sequence. 

(iii) Typicalness: Random sequences pass every statistical test of randomness. 

Can our intuition on randomness be cast in more rigorous terms? Randomness plays an essen- 
tial role in probability theory, the mathematical calculus of random events. Kolmogorov axiomatic 
probability theory assigns probabilities to sets of outcomes and shows how to calculate with such 
probabilities; it assumes randomness, but does not distinguish between individually random and 
non-random elements. 

For example, under a uniform distribution, the outcome of n zeros, 000 — 0, has the same 

n times 

probability as any other outcome of length n, namely 2~". A similar situation appears in quantum 
mechanics: quantum randomness is postulated, not defined or deduced. 

Algorithmic information theory (AIT) yj], developed in the 1960s, defines and studies individ- 
ual random objects, like finite bitstrings or infinite sequences. AIT shows that "pure randomness" 
or "true randomness" does not exist from a mathematical point of view. For example, there is no 
infinite sequence passing all tests of randomness. Randomness cannot be mathematically proved: 
one can never be sure a sequence is random, there are only forms and degrees of randomness. 

Computers offer "random numbers" produced by algorithms. Computer scientists needed a 
long time to realize that randomness produced by software is not random, but only pseudo-random. 
This form of randomness mimics well the human perception of randomness, but its quality is 
rather low because computability destroys many symptoms of randomness, e.g. unpredictability. 
It is not totally unreasonable to put forward that pseudo-randomness rather reflects its creators' 
subjective "understanding" and "projection" of randomness fl2fl. And although no computer or 
software manufacturer claims that their products can generate truly random numbers, recently such 
formally unfounded claims have re-appeared for randomness produced with physical experiments 
suggesting that "truly random numbers have been generated at last" oikl]. 

2 



II. QUANTUM RANDOMNESS 



A. Theoretical claims to quantum randomness 

Quantum mechanics has a credible claim to be one of (if not) the best sources of randomness. 
There are many quantum phenomena which can be used for random number generation: nuclear 
decay radiation sources, the quantum mechanical noise in electronic circuits (known as shot noise), 
or photons traveling through a semi-transparent mirror. 

What is the rationale for the claim that quantum randomness is indeed a better form of 
randomness than, say, pseudo-randomness? A quantum random experiment certified by value 
indefiniteness — the fact that there can, in general, be no co- or pre-existing definite values pre- 
scribable to certain sets of measurement outcomes J5I, Q] — via the Kochen-Specker Theorem [7] 
generates an infinite (strongly) incomputable sequence of bits: every Turing machine can repro- 
duce exactly only finitely many scattered digits of such an infinite sequence, i.e. the sequence is 
bi-immune [|5j]. Such certification, as has already previously been pointed out in ||5|], is based on the 
assumption that there are no contextual hidden variables. Actually, a stronger statement is true: no 
Turing machine can be proved to reproduce exactly any digit of such an infinite sequence, i.e. it is 
Solovay bi-immune [Q]. Indeed, if the value of a bit could be computed before measurement then 
we could assign a definite value to the observable, a contradiction. The tricky part is that we need 
to look at infinite sequences to prove the incomputability of individual bits. It is this formal incom- 
putability which corresponds to the physical notion of indeterminism in quantum mechanics — the 
inability even in principle to predict the outcome of certain quantum measurements — rather than 
the mathematically vacuous notion of "true randomness." 

Quantum random number generators (QRNGs) based on beam splitters Jf], [k]] have been real- 
ized by the Zeilinger group in Innsbruck and Vienna 111 ill and applied for the sake of violation of 
Bell's inequality under strict Einstein locality conditions 111211 . 

The Gisin group in Geneva y_3], and in particular its spin-off id Quantique, produces and 
markets a commercial device called Quantis \1M- In order to eliminate bias, the device employs 



von Neumann normalization (actually a more efficient iterated version due to Peres is used [15]) 



which requires the independence of individual events: bits are grouped into pairs, equal pairs (00 



or 1 1) are discarded and we replace 01 with and 10 with 1 [16] 



A group in Shanghai and Beijing [17] has utilized a Fresnel multiple prism as polarizing beam 



splitter. As a normalization technique, previously generated experimental sequences have been 
used as one time pad to "encrypt" random sequences. 



QRNGs based on entangled photon pairs have been realized by a second Chinese group in Bei- 



jing and Ji'nan 111811 . who utilized spontaneous parametric down-conversion to produce entangled 
pairs of photons. One of the photons has been used as trigger, mostly to allow a faster data pro- 
duction rate by eliminating double counts. Again, von Neumann normalization has been applied 
in an attempt to eliminate bias. 

A group from the Hewlett-Packard Laboratories in Palo Alto and Bristol J19I1 has used entan- 
gled photon pairs in the Bell basis state \H1V2) + \V1H2) (note that this is not a singlet state and 
attains this form only for one polarization direction; in all the other directions the state contains 
also V1V2 as well as H1H2 contributions), where the outcomes H\,V\ and H2,V2 refer to observ- 
ables associated with unspecified (presumably identical for both particles) directions. In analogy 
to von Neumann normalization, the coincidence events H1V2 and V1H2 have been mapped into 
and 1, respectively. Thereby, as the authors have argued, the 2-qubit space of the photon pair is 
effectively restricted to a two-dimensional Hilbert subspace described by an effective-qubit state. 



A more recent rendition of a QRNG 120(1 • although not based on photons and beamsplitters, 



utilizes Boole-Bell-type setups "secured by" Boole-Bell-type inequality violations in the spirit of 



quantum cryptographic protocols fell 12211 . This provides some indirect "statistical verification" 



of value indefiniteness (again under the assumption of noncontextuality), but falls short of provid- 
ing certification of strong incomputability via value indefiniteness J5, 2st- With regard to value 
indefiniteness, the difference between Boole-Bell-type inequalities versus Kochen-Specker-type 
theorems is this: In the Boole-Bell-type case, the breach of value indefiniteness needs not hap- 
pen at every single particle, whereas in the Kochen-Specker-type case this must happen for every 
particle [6]. Pointedly stated, the Boole-Bell-type violation is statistical, but not necessarily on 
every quantum separately. Hence, because a Boole-Bell-type violation does not guarantee that 
every bit is certified by value indefiniteness, one could potentially produce sequences containing 
infinite computable subsequences "protected" by Boole-Bell-type violations. Further, given that 



such criticisms seem also to hold for the statistical verification of value indefiniteness fl24l- l26|l . it 
seems unlikely that statistical tests of the measurement outcomes alone can fully certify such a 
QRNG. 



B. Shortcomings of current QRNGs 



It is clear that any QRNG claiming a better quality of randomness has to produce at least 
an infinite incomputable sequence of outputs, preferably a strongly incomputable one. Do the 
current proposals of QRNGs generate "in principle" strongly incomputable sequences of quantum 
random bits? To answer this question one has to check whether the QRNG is "protected" by value 
indeflniteness, the only physical principle currently known to guarantee incomputability; in most 
cases the answer is either negative or cannot be verified because of lack of information about the 
mechanism of the QRNG. 

In Ref. [27Q tests based on algorithmic information theory were used to analyze and compare 
quantum and non-quantum bitstrings. Ten strings of length 2 32 bits each from two quantum sources 
(the commercial Quantis device [28] and the Vienna Institute for Quantum Optics and Quantum 
Information group 1290) and three classical sources (Mathematica, Maple and the binary expansion 
of 7l) were analyzed. No distribution was assumed for any of the sources, yet a test based on 
Borel-normality was able to distinguish between the quantum and non-quantum sources of random 



numbers. It is known that all algorithmically random strings are Borel-normal 113011 . although the 
converse is not true. Indeed, the tests found the quantum sources to be less normal than the 
pseudo-random ones. Is this a property of quantum randomness, or evidence of flaws in the tested 
QRNGs? 



In Ref. [311] the probability distribution for an ideal QRNG was discussed: not surprisingly, 



such devices are seen to sample from the uniform distribution. Testing the same strings as in Q2VD 
against this expected distribution, strong evidence was found that the QRNGs tested are not sam- 
pling from the correct distribution. Further, weaker evidence suggests the pseudo-random sources 
of randomness — Mathematica and Maple — are, on the contrary, too normal. The results of the 
analysis are presented in Table HI 

The notable exception to these findings are the Vienna bits which, when viewed at the single-bit 
level, appear unbiased. It appears that the good performance at the 1-bit level has been achieved 
(perhaps through experimental feedback control) at the sacrifice of the performance at the k > 2 
level, a property much harder to control without post-processing. The Quantis QRNG uses iterated 
von Neumann normalization in an attempt to unbias the output; the fact that this is not completely 
successful indicates either a significant variation in bias over time, or non-independence of suc- 



cessive bits [31] 



QRNG k = 1 £ = 2 k = 3 k = 4 k = 5 



Maple 


0.79 


0.15 


0.83 


0.47 


0.97 


Mathematica 


0.18 


0.38 


0.35 


0.45 


0.99 




0.38 


0.27 


0.05 


0.62 


0.21 


Quantis 


< 10 10 


< 10 10 


< 10 10 


< 10 10 


< 10 10 


Vienna 


0.12 


< 10 10 


< 10 10 


< 10 10 


< 10 10 



TABLE I. p-values for the % 2 test that the bitstring is sampled from the uniform distribution. Bold values 
indicate statistically significant evidence that the strings are not sampled from the uniform distribution. 

These results highlight the need to pay extra attention in the design process to the distribution 
produced by a QRNG. Normalization techniques are an effective way to remove bias, but to have 
the desired effect assumptions about independence and constancy of bias must be satisfied IL31 1 . 
While experiments will never realize the ideal QRNG, one needs to be aware of how much affect 
experimental imperfections have. Any credible QRNG should take these issues into account, as 
well as the need of explicit certification of randomness by some physical law, e.g. value indefinite- 
ness. 



III. THE SCHEME UNDER IDEAL CONDITIONS 



In what follows, a proposal for a QRNG depicted in Fig.Ql previously put forward in Ref. Q23U , 
will be discussed in detail. It utilizes the singlet state of two two-state particles (e.g., photons of 
linear polarization) proportional to \H1V2) — \V\H2), which is form invariant in all measurement 
directions. 

A single photon light source (presumably an LED) is attenuated so more than one photons are 
rarely in the beam path at the same time. These photons impinge on a source of singlet states of 
photons (presumably by spontaneous parametric down-conversion in a nonlinear medium). The 
two resulting entangled photons are then analyzed with respect to their linear polarization state at 
some directions which are 71/4 radians "apart," symbolized by "©" and "(g)," respectively. 

Due to the required four-dimensional Hilbert space, this QRNG is "protected" by Bell- as well 
as Kochen-Specker- and Greenberger-Horne-Zeilinger-type value indefiniteness [32]. The proto- 
col utilizes all three principal types of quantum indeterminism: (i) the indeterminacy of individual 
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FIG. 1. Scheme of a quantum random number generator [23]. 



outcomes of single events as proposed by Born and Dirac; (ii) quantum complementarity (due 
to the use of conjugate variables), as put forward by Heisenberg, Pauli and Bohr; and (iii) value 
indefiniteness due to Bell, Kochen & Specker, and Greenberger, Home & Zeilinger. 

This, essentially, is the same experimental configuration as the one used for a measurement 
of the correlation function at the angle of n/4 radians (45°). Whereas the correlation function 
averages over "a large number" of single contributions, a random sequence can be obtained by 
concatenating these single pairs of outcomes via addition modulo 2. 

Formally, suppose that for the zth experimental run, the two outcomes are Of G {0, 1} corre- 
sponding to Dq or Df, and Of G {0, 1} corresponding to D® or Df. These two outcomes Of 
and Of, which themselves form two sequences of random bits, are subsequently combined by the 
XOR operation, which amounts to their parity, or to the addition modulo 2 according to Table [TT] (in 
what follows, depending on the formal context, XOR refers to either a binary function of two binary 
observables, or to the logical operation). Stated differently, one outcome is used as a one time pad 
to "encrypt" the other outcome, and vice versa. As a result, one obtains a sequence x = x\x% ...x n 
with 



For the XORd sequence to still be certifiably incomputable (via value indefiniteness), one must 
prove this certification is preserved under XORing — indeed strong incomputability itself is not nec- 
essarily preserved. By necessity any QRNG certified by value indefiniteness must operate non- 
trivially in a Hilbert space of dimension n > 3. To transform the n-ary (incomputable) sequence 
into a binary one, a function / : {0, 1, . . . ,n — 1} — > {0, 1 , A,} must be used (k is the empty string); 



Xi = 



Of + Of mod 2. 



(1) 



7 



of 


of 


Of XOR Of 














1 


1 


1 





1 


1 


1 






TABLE II. The logical exclusive or operation. 

to claim certification, the strong incomputability of the bits must still be guaranteed after the ap- 
plication of /. This is a fundamental issue which has to be checked for existing QRNGs such 



as that in Ref. Q20] ; without it one cannot claim to produce truly indeterministic bits. In general 
incomputability itself is not preserved by /; however by consideration of the value indefiniteness 
of the source the certification can be seen to hold under XOR as well as when discarding bits (8J]. 



IV. "RANDOM" ERRORS OR SYSTEMATIC ERRORS 

In what follows we shall discuss possible "random" (no pun) or systematic errors in experi- 
mental realizations of this QRNG (many of these errors may appear in other types of photon-based 
QRNGs.) Our aim is to draw attention to the specific nature of such errors and how they affect the 
resulting bitstrings. A good QRNG must, in addition to the necessary certification (e.g. by value 
indefiniteness), take into account the nature of these errors and be carefully designed (along with 
any subsequent post-processing) so that the resultant distribution of bitstrings the QRNG samples 
from is as close as possible to the expected uniform distribution [31]. Both the uniformity of the 
source and incomputability are "independent symptoms" of randomness, and care must be taken 
to obtain both properties. 



A. Double counting 

One conceivable problem is that the detectors analyzing the different polarization directions 
do not respond to photons of the same pair, but to two photons belonging to different pairs. This 
seems to be no drawback for the application of the XOR operation since (at least in the absence of 
temporal correlations between bits) the postulates of quantum mechanics state that the individual 
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outcomes occur independently and indeterministically (the last property is mathematically mod- 
eled by strong incomputability [|5|,|8|]). If, however, events are not independent then more care is 
needed. However, correlation between events is an undesirable property in itself, and as long as 
care is made, it is unlikely to be made worse by double counting. 

B. Non-singlet states 

The state produced by the spontaneous parametric down-conversion may not be exactly a sin- 
glet. This may give rise to a systematic bias of the combined light source-analyzer setup in a very 
similar way as for beam splitters. 

C. Non-alignment of polarization measurement angles 

No experimental realization will attain a "perfect anti-alignment" of the polarization analyzers 
at angles 7l/4 radians apart. Only in this ideal case are the bases conjugate and the correlation 
function will be exactly zero. Indeed, "tuning" the angle to obtain equi-balanced sequences of 
zeroes and ones may be a method to properly anti-align the polarizers. However, one has to keep 
in mind that any such "tampering" with the raw sequence of data to achieve Borel normality (e.g. 
by readjustments of the experimental setup) may introduce unwanted (temporal) correlations or 



other bias Il27h 



Incidentally, the angle tc/4 is one of the three points at angles 0, n/4 and n/2 in the interval 
[0,7t/2] in which the classical and quantum correlation functions coincide. For all other angles, 
there is a higher ratio of different or identical pairs than could be expected classically. Thus, 
ideally, the QRNG could be said to operate in the "quasi classical" regime, albeit fully certified by 
quantum value indefiniteness. 

Quantitatively, the expectation function of the sum of the two outcomes modulus 2 can be 
defined by averaging over the sum modulo 2 of the outcomes O®, Of £ {0, 1} at angle "apart" in 

the ith experiment, over a "large number" of experiments; i.e., 

N 



£ X0R (e) = Hm i £ (of + Of mod 2) . 



(=i 

This is related to the standard correlation function, 

N 



c(e)=ijmiEo?-of 



by 



£xor(0) 



|C(9)-1| 



where 



1 if 0° = 0° 

of- of ' ' * 

-1, if of ^ of. 



A detailed calculation yields the classical linear expectation function jE'xorW = 1—20/71, and the 
quantum expectation function £xor (9) = ( 1 /2) ( 1+ cos 20) . 




FIG. 2. (Color online) The classical and quantum expectation functions and the linear quantum approxima- 
tion around n/4. 

Thus, for angles "far apart" from 7C/4, the XOR operation actually deteriorates the two ran- 
dom signals taken from the two analyzers separately. The deterioration is even greater quantum 
mechanically than classically, as the entangled particles are more correlated and thus "less in- 
dependent." Potentially, this could be utilized to ensure a 7t/4 mismatch more accurately than 
possible through classical means. This will be discussed in section IVl below. 

In order to avoid this negative feature while generating bits, instead of XORing outcomes of 
identical partner pairs, one could XOR time-shifted outcomes; e.g., instead of the expression in 
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Eq. (OQ) one may consider 

Xi = <9° + Oi +J mod 2, with j > 0. (2) 

One should make j large enough so that, taking in to account double counting, there is no chance of 
accidentally causing two offset but correlated outcomes to be XOR'd together. Theoretical analysis 
of the effects of experimental imperfections and the XOR operation are discussed later in the paper, 
and XORing shifted pairs is an efficient and effective procedure for reducing such errors. 

D. Different detector efficiencies 

Differences in detector efficiencies result in a bias of the sequence. This complicating effect 
is separate from non-perfect misalignment of polarization context. Suppose that the probabilities 
of detection are denoted by pn x , Ph 2 , Pv x , Pv 2 - Since pu x + pv x = Ph 2 + Pv 2 = 1, the probability 
to find pairs adding up to and 1 modulo 2 are PhiPh 2 + PViPv 2 = 1 — (phi + Ph 2 ) + ^Ph x Ph 2 
and p Hx Pv 2 + Pv x Ph 2 = Ph x + Ph 2 ~ 2ph x Ph 2 , respectively (adding up to 1). If both p Hl ^ p Vl 
and ph 2 ^ Pv 2 then the resulting XOR'd sequence is biased. The two obtained sequences could be 
unbiased before or after XORing by the von Neuman method ni6L p. 768], although any temporal 
correlations would violate the condition of independence required by this method. One should 
keep in mind, however, that the von Neumann normalization procedure necessarily discards many 
bits (more efficient methods exist JlsL . The efficiency can be increased by utilizing both strings 
more carefully, and such a method is discussed in Section |VID[ 



E. Unstable detector bias 

Von Neumann type normalization procedures will only remove bias due to detector efficiencies 
if the bias remains constant over time. If the bias drifts over time due to instability in the detectors, 



the resulting normalized sequence will not be unbiased but instead will simply be less biased Bill 



It is difficult to overcome this, as experimental instability is inevitable. However, bounds on the 



bias of the normalized sequence based on reasonable experimental parameters Bill can be used to 
determine the length for which the source samples "closely enough" from the uniform distribution. 

If the bias varies independently between detectors, the XORing process should serve to reduce 
the impact of varying detector efficiencies and applying von Neumann normalization to the XOR'd 
bitstring is advantageous compared working with a single bitstring from a source of varying bias. 
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F. Temporal correlations, photon clustering and "bunching" 



Due to the Hanbury-Brown-Twiss effect, the photons may be temporally correlated and thus 
arrive clustered or "bunched." Temporal correlations appear also at "double-slit analogous exper- 



iments" in the time domain [33], in which the role of the slits is played by windows in time of 
attosecond duration. This can, to an extent, be avoided by ensuring successive photons are suf- 
ficiently separated, although this poses a limit on the bitrate of such a device. However, since 
the case where two or more singlet pairs are in the beam path at once is potentially of sufficient 
importance, this effect needs further careful consideration. 

Another conceivable source of temporal correlations is due to the detector dead-time, 7^, during 
which the detector is inactive after measurement fl 1 3M - If we measure Of = 0, the detector Dq 
corresponding to is unable to detect another photon for a small amount of time, significantly 
increasing the chance of detecting a photon at the other detector during this time, obtaining a 1 . 
This leads to higher than expected chances of 01 and 10 being measured. This is problematic as 
such a correlation will not be removed by XORing, even with an offset of j. However, this can be 
avoided by discarding any measurements within time from the previous measurement. 

In view of conceivable temporal correlations, it would be interesting to test the quality of the 
random signal as j is varied in Eq. ©. As previously mentioned, any temporal correlations will 
violate the condition of independence needed for von Neumann normalization making it difficult to 
remove any bias in the output; if the dependence can be bounded then unbiasing techniques such as 
that proposed by Blum [|34f | could be used instead of von Neumann's procedure. It seems desirable 
and simpler to avoid temporal correlations with carefully designed experimental methodology as 
opposed to post-processing where possible. 



G. Fair sampling 



As in most optical tests of Bell's inequalities H35L 13611 . the inefficiency of photon detection 
requires us to make the fair sampling assumption |37- 4o|] : the loss is independent of the measure- 



ment settings, so the ensemble of detected systems provides a fair statistical sample of the total 
ensemble. In other words, we must exclude the possibility of a "demon" in the measuring device 
conspiring against us in choosing which bits to reject. 

The strength of the proposed QRNG relies crucially on value indefiniteness, so without this fair 



12 



sampling assumption we would forfeit the assurance of bitwise incomputability of the generated 
sequence. As an example let us consider the extreme case that the detection efficiency is less that 
50%; our supposed demon could reject all bits detected as and be within the bounds given by this 
efficiency, while the produced sequence would be computable. In the more general case for any 
efficiency p < 1 the demon could reject bits to ensure every (1/(1 — p) )'th bit is a zero; this would 
introduce an infinite computable subsequence, a property violating the strong incomputability of 
the output bitstring produced by our QRNG, and still be consistent with the detection efficiency. 

Note that this condition is stronger than the fair sampling assumption required in tests for 
violation of Bell-type inequalities because, without this assumption, any inefficiency can lead to a 
loss of randomness. 



V. BETTER-THAN-CLASSICAL OPERATIONALIZATION OF SPATIAL ORTHOGONALITY 

As has already been pointed out, for no temporal offset and in the regime of relative spatial 
angles around n/4 — i.e., at almost half orthogonal measurement directions — the classical linear 
expectation function E^ QR (B) = 1 — 20/tc, for < 9 < n/4 is strictly smaller, and for n/4 < < 
7t/2 is strictly greater than the quantum expectation function £xor(0) = (1/2)(1 + cos 20). This 
can be demonstrated by rewriting = 7t/4±A0, and by considering a Taylor series expansion 
around 7l/4 for small A0 < 1, which yields E X0R (n/4 ± A0) « (1/2) =fA0, whereas E^ QR (n/4± 
A0) = (1/2) T (2/71) A0 (see Fig.©. 

Phenomenologically this indicates less-than-classical numbers of equal pairs of outcomes "0- 
0" as well as "1-1," and more-than-classical non-equal pairs of outcomes "0-1" as well as "1-0," 
respectively, for the quantum case in the region < < 7t/4; as well as the reverse behavior in 
the region n/4 < < Tt/2. This in turn results in "less zeroes" and "more ones" of the resulting 
sequence obtained by XORing the pairs of outcomes in the region < < n/4, as well as in "more 
zeroes" and "less ones" in the region 7c/4<0<7t/2as compared to classical non-entangled 
systems [41]. Hence, with increasing aberration from misalignment A0 the quantum device "drifts 
off" into biasedness of the output "faster" than any classical device. As a result, Borel normality 
is expected to be broken more strongly and quickly quantum mechanically than classically. 

This effect could in principle be used to operationalize spatial orthogonality through the fine- 
tuning of angular directions yielding Borel normality. In the resulting protocols, quantum mechan- 
ics outperforms any classical scheme due to the differences in the correlation functions. 
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VI. THEORETICAL ANALYSIS ON GENERATED BITSTRINGS 

Here we analyze the output distribution of the proposed QRNG and the ability to extract uni- 
formly distributed bits from the two generated bitstrings in the presence of experimental imper- 
fections. 



A. Probability space construction 

With reference to Fig.Q]for the setup, we write the generated Bell singlet state with respect the 
top ("©") measurement context (this is arbitrary as the singlet is form invariant in all measurement 
directions) as — 1 10)). The lower ("(g)") polarizer is at an angle of to the top one. After 

beam splitters we have the state 

4=[cos9(|00)- |H))-sin0(|Ol) + |lO))], 
v2 

so we measure the same outcome in both contexts with probability cos 2 9 and different outcomes 
with probability sin 2 0. 

More formally, the QRNG generates two strings simultaneously, so the probability space con- 
tains pairs of strings of length n. Let ef,e® for x,y = 0, 1 be the detector efficiencies of the Df 
and Dy detectors respectively. For perfect detectors, i.e e® = e® , we would expect a pair of bits 
(a, b) to be measured with probability 2 _1 (sin 2 0) aeil (cos 2 0) l ~ a ® b ; non-perfect detectors alter this 
probability depending on the values of a, b. 

Let B = {0, 1}, and for x,y E B n let d(x,y) be the Hamming distance between the strings x and 
y, i.e the number of positions at which x and y differ, and let #b(x) be the number of bs in x. 



The probability space 142D of bitstrings produced by the QRNG is (B n x B'\ 2 B " xB \P n i), where 
the probability P n i : 2 B " xB " [0, 1] is defined for all X C B n x B n as follows: 

P n2 (X) = — £ (sin 2 0) rf ^(cos 2 0) n - rf( ^ ) (e®) #o(x) (e®) #l(x) (ef ) #oW (ef ) #lM , 

Z ' J (x,y)eX 

and the term 

Z n = £ (sm 2 d) d ^\cos 2 d) n - d ^\e®)^ 

= [(sin 2 Q(e®ef + efe®) + cos 2 Q(e®e® + efef)] " 
ensures normalization. 
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We can check easily that this is indeed a valid probability space (i.e. that is satisfies the Kol- 
mogorov axioms Ii43ll ). Note that for equal detector efficiencies we have 

Z n = (e®) n {e®) n £ (sin 2 0)^(cos 2 0)' , ^'>') = 2"(e®)>®)", 

(x,y)eB n xB n 

hence the probability has the simplified form 

P n2 (X)= £ 2-"(sin 2 0) d ^(cos 2 0)"- rf ^. 

(x,y)ex 

Given that the proposed QRNG produces two (potentially correlated) strings, it is worth consid- 
ering the distribution of each string taken separately. Given the rotational invariance of the singlet 
state this should be uniformly distributed. However, because the detector efficiencies may vary in 
each detector, this is not, in general, the case. For every bitstring x G B n we have 

P n2 ({x}xB n ) = — £ (sin^^'-^cos 2 ©)' 1 ^ 

Zn yeB n 

( „®\#q{x) ( (x) 

= W Vi2 £ (sin 2 0)^(cos 2 0)"-^(e®) #o W(ef^ #1 W 



Z, 



yeB" 



= 1 (e®(ef sin 2 + e®cos 2 0)) #oW (ef(e® sin 2 + ef cos 2 0)) #lW . (3) 

We see that each bitstring taken separately appears to come from a constantly biased source 
where the probabilities that a bit is or 1, pq, p\ , are given by the formulae 

po = e® (ef sin 2 + e® cos 2 Q)/Z uPl = ef(e® sin 2 + ef cos 2 0) jZ x . 

This can alternatively be viewed as the distribution obtained if we were to discard one bitstring 
after measurement. Note that if either = ef or we have perfect misalignment (i.e. = 7l/4) 
then the probabilities have the simpler formulae: 

Px = e®/(e® + ef),xe{0,l}. 

In this case, if we further have that e® = ef, we obtain the uniform distribution by discarding one 
string after measurement. 

The analogous result for the symmetrical case P n i (B n x {y}) also holds. 



B. Independence of the QRNG probability space 



If we were to discard one bitstring it is clear the other bitstring is generated independently in 
a statistical sense since the probability distribution source producing it is constantly biased and 
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independent [31]. However, we would like to extend our notion of independence defined in [3 1 ] 
to this 2-bitstring probability space. 

We say the probability space (B n x B n 1 2 B " xB '\R n 2) is independent if for all 1 < k < n and 
xi,...,x k ,yi,...,y k eBwe have 

R n 2{x x . . .x k B n ~ k x yi .. .y k B n - k ) =R n2 (x l . . .x^B^ 1 xy r .. .y^B^ 1 ) 

x R n2 {B k - l x k B n - k x B k - l y k B n - k ). 

For all B^ and < k+ \x\ < n we have 

P n2 (B n - k xB n - k -W x B n - k yB n - k -W) = P ]x]2 ((x,y)). 

Indeed, using the additivity of the Hamming distance and the # x functions, e.g. 
d{x\ ...x k ,y 1 ...y k ) = d{x\ ...x k -\,y\.. .y k -i) + d(x k ,y k ), we have: 

P n 2(B n - k xB n - k -M x fi»-*y5»-*-W) = £ £ P n2 ((a l xb 1 ,a 2 yb 2 )) 

ai ,a 2 eB"- k b x ,b 2 eB"- k -\ x \ 

= p \x\2((x,y)) £ £ / 5 ( „_ W) 2((ai^i,a 2 ^2)) 

a! ,a 2 eB"- k b l ,b 2 eB"- k -\ x \ 

As a direct consequence we deduce that the probability space P n i defined above is independent. 



C. XOR application 

We now consider the situation where the two output bitstrings x and y are XOR'd against each 
other (effectively using one as a one-time pad for the other) to produce a single bitstring, and we 
investigate the distribution of the resulting bitstring. Rather than only considering the effect of 
XORing paired (and potentially correlated) bits, we also consider XORing outcomes shifted by j > 
bits as described in Section ITVCl 

For j > and xjG B n+ i define the offset-XOR fucntion Xj : B n+ i x B' 1+ J ->■ B n as Xj(x,y) = z 
where zi = Xi © yi + j for i = 1 , . . . , n. For z G B n the set of pairs (x, y) which produce z when XOR'd 
with offset j is 

Aj(z) = {(x,y) | x,y G J B' I+ - / ',X J -(x,y) = z} = {(ua,b(u XORz) | m G fi n ,a,& G #'}. 
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The probability space of the output produced by the QRNG is (B n , 2 s ", Q n j), where Q n j : 2 s " — > 
[0, 1] is defined for all X C B n as: 

Qnj(X) = Y, P (n+jH A j(z))- (4) 

We note that \Aj(z) \ = 2 n+2 i and check this is a valid probability space. Indeed, Q n j(Q) — 0, is 
trivially true, 

CM**) = I V;) 2 ^^)) = V/) 2 ( IM*) J = ( B ' l+J >< = i. 

zeB" V z / 

bcause all Aj(z) are disjoint and thus 

| \jAj(z)\ = 2 n 2 n+2 J = (2 n+ J)\ so \jAj(z) = B n+ J x B n+ i, 

z z 

and for disjoint XJ CB n we have Q n ,j(X UY) = Q n j(X) + Q n j(Y). 

We now explore the form of the XOR'd distribution Q n j for j = and j > 0. 

Let z G 5" and j > 0. By z[m, k] we denote the substring z m . . .z&, 1 < m < k < n. We have 

Qn,j(z) =P [n+J) 2(Aj(z))) 

= E E V)) 2 (( Bfl ' fe ( HX0Rz )) 

= E V./) 2 ( ( M L/ + 1 , n] , (u XOR z) [ 1 , n - j] ) ) 

u<E2 n 

■ £P j2 ((a,( M X0Rz)[n-j + l,n])) £ Pj*{(u[LJ],b)). 

For j = 0, we note that d(u, u XOR z) = #i (z), and thus we have: 
6«,o(z) = £P n 2 ((«,(« XOR z))) 

= l( s in 2 0) # i( z )(cos 2 0) #0 ^ £ ^©^oW^^^W^^tto^xoRzj^^i^xoRz) 

= 1 (sin 2 9( e ® e f + (cos 2 0( e ® e ® + e f e f )) #o(z) . 

We recognize this as a constantly biased source where 

= cos 2 0(e®e® + e®ef )/Z l7 Pl = sin 2 0(e®ef +efe®)/Z h 

It is interesting to compare the form of Q n q to the distribution of the constantly biased source 
Eq. © by discarding one output string — the former is more sensitive to misalignment, the latter 
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to differences in detection efficiencies. In the case of perfect/equal detector efficiencies (but non- 
perfect misalignment), discarding one string produces uniformly distributed bitstrings, whereas 
XORing does not. 

We now look at the case where j > 0. For the ideal situation of = n/4 we have the same 
result as for the j = case, while if we have equal detector efficiencies then we get the uniform 
distribution. We show this as follows (note that Z n+ j = 2 n+ j in this case): 

Q nJ (z) =2~ n ~ j £ • • • £ (sin 2 Q) u n®z„-j®u n ^j ( CQS 2 Qy-u n ®z n -j®u n -j . . . 

u n eB u n -j<EB 

x £ (sin 2 e)"/^ 1 ©^©"! (cos 2 e) 1 -";® 1 ©^©"! 

iil<EB 

=2 -*-;'£... £ (sin 2 + cos 2 0)- £ (sin 2 + cos 2 0) 

w n €fi u n -j(zB u\(EB 

=2~ n -j £ 1 
=2-". 

However, in the more general case of non-equal detector efficiencies, the distribution is no 
longer independent, although in general is much closer to the uniform distribution than the j = 
case. (Recall that independence is a sufficient but not necessary condition for uniform distri- 



bution 113 lh .) It is indeed this "closeness" — the total variation distance given by A(U„,Q„j) = 
lExeS" 1 2 " — Qnj(x)\ — which is the important quantity (U n is the uniform distribution on n-bit 
strings). However, since Q n j for j > is not independent, von Neumann normalization cannot 
be applied to guarantee the uniform distribution; indeed the dependence is not even bounded to a 
fixed number of preceding bits. 



D. Criticisms and alternative operationalizations 

This given, one may ask why not simply discard one string to give the distribution in Eq. © 
and apply von Neumann normalization to obtain uniformly distributed bitstrings. There are two 
primary answers to this question. 

(i) As discussed previously the effect of drift in bias and temporal correlations will ensure this 
method will not produce the uniform distribution anyway. Indeed, the distribution Q n j for j > 
should be more robust to those effects (Q n j for example is less sensitive to detector bias than 
that in Eq. ©). It is extremely plausible that Q n j gives as good results as discarding one string in 
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x bin(174) bin(487) bin(973) 
<2io,oW 5.90 x 10- 4 9.70 x 10~ 4 1.64 x 10~ 4 
Qio,i (x) 9.75 x 10~ 4 9.71 x 10~ 4 9.71 x 10~ 4 
6io,2(x) 9.78 x 10- 4 9.70 x 10~ 4 9.70 x 10~ 4 
U w (x) 9.77 x 10~ 4 9.77 x 10~ 4 9.77 x 10~ 4 

TABLE III. Emperical evidence for the quality of XORing with j > compared to j = and configuration 
settings of 6 = Jl/5, = 0.30, ef = 0.33, ef = 0.29, ef = 0.30 — this is probably much worse (further 
from the ideal case) that one would expect in an experimental setup. The (small) value of n = 10 has been 
used as, unfortunately, the distribution is very costly to calculate numerically. Here bin(m) denotes the (10- 
bit zero-extended) binary representation of m. For example, bin(l) = 0000000001, bin(2) = 0000000010, 
etc. 

A(<2io,o,t/io) 0.770271 
A(gio,i,t/io) 0.00441399 
A(gio,i,t/io) 0.00440061 



TABLE IV. The variation from the uniform distribution of the distributions <2ioj> using the same parameters 
as Table M 

practice; it is indeed very close to the uniform distribution as can be seen from Table ITVl and Fig. [3] 
To compare properly the distributions, the following open question must be answered: what is the 
bound p depending on ef,e® and such that A(U n , Q n ,j) < P> and how does that compare to that 
given in |3l|] for normalization of a source with varying bias? 

Further, Q n j produces bitstrings of length n, whereas applying von Neumann to a single string 
produces a string with expected length at most n/4 bits. This is a significant increase in efficiency, 
making the shifted XORing process extremely appealing for a high bitrate, un-normalized QRNG. 
Even the j = case with von Neumann applied after XORing would often be preferable to dis- 
carding one string, since it is less sensitive to detector efficiency (the hardware limit) and more 
sensitive to to misalignment (which is controlled by the experimenter). 

(ii) If one insists on a perfect theoretical distribution in the presence of non-ideal misalignment 
and unequal detector efficiencies, or perhaps the Q n j distribution is not sufficient for particular 
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FIG. 3. (Color online) A plot of QiOj — 2 f° r eacn of the 2 strings of length 10. The two cases j = 
(blue) and j = I (red) show how much closer the probabilities given by <2io,i are to that expected from the 
uniform distribution than for <2io,o- The same experimental configuration as in Table ITVl has been used. 

requirements, then one can still operationalize both strings to improve the efficiency of the QRNG 
over discarding a single string by a simple modification of von Neumann's procedure. To do 
so, note that the pair of pairs (a\a2,b\b2) have the same probability as the pairs (aiai^bi). 
By mapping those with a\b\ < «2^2 (lexicographically) to 0, those with a\b\ > atbt to 1, and 
discarding those with a\b\ = a2^2, one will obtain the uniform distribution as for von Neumann's 
procedure. The key advantage is that this will obtain strings of expected length up to 3rc/8, while 
maintaining the desired property of sampling from the uniform distribution. 

The problem of determining how best to obtain the maximum amount of information from the 
QRNG is largely a problem of randomness extractors I44L and is a trade off between the number 
of uniformly distributed bits obtained and the processing cost — a suitable extractor needs to op- 
erate in real-time for most purposes. As we have seen, the fact that two (potentially correlated) 
bitstrings are obtained allows more efficient operation than a QRNG using single-photons. We 
have shown how the proposed QRNG can be operationalized in more than one way: either by us- 
ing shifted XORing of bits to sample from a distribution which is close to (equal to in the ideal limit) 
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the uniform distribution and efficient and robust to various errors, or by utilizing both produced 
bitstrings to allow a more efficient normalization procedure giving (in absence of the aforemen- 
tioned temporal effects) the uniform distribution. Many more operationalizations are undoubtedly 
possible. 

VII. SUMMARY 

Every QRNG claiming to produce a better form of randomness than pseudo-randomness must 
firstly be certified by some physical law implying the incomputability of the output bitstrings; 
value indefiniteness is one such example. Most existing proposals of QRNGs are based on single 
beam splitters and work in a dimension-two Hilbert space, so they cannot be certified by value 
indefiniteness given by the Kochen-Specker theorem (which holds only in a Hilbert space of di- 
mension greater than 2). In this paper we have proposed a QRNG which, by utilizing an entangled 
photon singlet-state in four-dimensional Hilbert space, is certified by value indefiniteness which 
implies strong incomputability, the mathematical property corresponding to physical indetermin- 
ism. While this is an ingredient of fundamental importance in any reasonable QRNG, we have 
recognized that experimental imperfections will always prevent the QRNG from producing ex- 
actly the theoretical uniform probability distribution, another essential symptom of randomness 
(independent of incomputability). The form and effects of these conceivable experimental errors 
have been discussed, and care has been taken to make the proposed QRNG robust to these effects. 

Since this QRNG produces two bitstrings, we have proposed XORing the bitstrings produced — 
using one as a one-time pad for the other — to obtain better protection against experimental im- 
perfections, particuarly non-ideal misalignment and unequal detector efficiencies, and utilize the 
benefit of these two strings over simply using one. Rather than XORing corresponding bits, bits 
Xi and yi + j are XOR'd (for fixed j > 0) as this not only provides much better results, but also mit- 
igates the effects of temporal correlations between adjacent bits. Further, we have proposed an 
alternative normalization method based on von Neumann's procedure which uses both bitstrings. 
This procedure is significantly more efficient yet still guarantees uniformly distributed strings in 
the presence of non-ideal misalignment and unequal detector efficiencies. We leave it as an open 
question to improve upon the time-shifted XOR method and find a technique to extract bits which 
are provably uniformly distributed and is more efficient than the improved von Neumann method 
discussed. 
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Analyses of sequences generated by the proposed QRNG should be conducted, utilizing the 
knowledge of the expected uniform distribution, as in 112711 . In particular, the quality of both the 
individual strings produced should be compared with that of the XOR'd sequence, both with and 
without von Neumann normalization applied, as well as the sequence produced by our improved 
von Neumann method. 

Further, in view of conceivable temporal correlations between bits, the quality of the random 
bits should be tested as j is varied in Eq. ©. Since this has little effect on the bias of the resultant 
string (and normalization can subsequently remove this), it would allow investigation of the effect 
and significance of these conceivable temporal correlations. 

The proposed QRNG produces bits which are both certified via value indefiniteness and should 
be distributed more uniformly than those produced by existing QRNGs based on beam splitters. 
It will be interesting to experimentally test the quality of bits produced via this method against 
existing classical and quantum sources of randomness. 
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